Intelligence Suite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:31 AM UTC
• Version: 1.0.3

Overview

The skill is a mostly coherent news scraper, but it can follow untrusted article links outside its declared network scope and feed scraped text back to the agent.

Review before installing. Use this only in an environment with restricted network egress, because linked articles can cause requests to hosts outside the listed news sources. Treat generated content as untrusted source material, pin dependencies with a lockfile, and avoid giving the consuming agent secrets or high-impact tools while summarizing scraped pages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan.js:33

Finding

Unrestricted Fetching of Attacker-Controlled Article URLs Enables SSRF

Content

View full analysis

s && KEYWORDS.some(k => s.title?.includes(k))) .slice(0, 3) .map(s => ({ source: "Hacker News", title: s.title, link: s.url || `https://news.ycombinator.com/item?id=${s.id}`, raw_summary: "Community discussion" })); ``` ```js for (const item of items) { console.log(`\nReading: ${item.title}...`); const content = await fetchContent(item.link); ``` From `scripts/monitor.js`: ```js async function fetchContent(url) { try { const { data } = await axios.get(url, { headers: { 'User-Agent': 'Mozilla/5.0 (compatible; MakimaBot/1.0)' }, timeout: 5000 }); const $ = cheerio.load(data); $('script, style, nav, footer, .ad').remove(); let text = $('article').text() || $('main').text() || $('body').text(); return text.replace(/\s+/g, ' ').trim().substring(0, 1000); } catch (e) { return "Content inaccessible."; } } ``` ```js for (const item of items) { let content = "Summary unavailable"; if (!ite ...[truncated 2405 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/scan.js:42

Finding

Untrusted Webpage Content Is Forwarded to the Agent Without Prompt-Injection Isolation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package.json:9

Finding

Non-Reproducible Dependency Installation Increases Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code does perform global news monitoring, which partially aligns with the description. However, it does not implement any AI-news-specific tracking logic, categorization, or sources, even though that is a central declared feature. Additionally, it adds an undeclared entertainment/celebrity scandal item via a hardcoded Weibo placeholder, which is outside the stated purpose. The implementation is essentially a simple RSS fetch-and-scrape monitor for a few sources rather than a broader all-seeing intelligence suite combining AI news and global monitoring.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

node scripts/scan.js --report

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest uses a caret range for axios, which allows installation of newer matching releases rather than a single fixed version. This is a supply-chain hardening weakness because builds may become non-reproducible and can unexpectedly pull in a vulnerable or compromised release within the allowed range.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "rss-parser": "^3.13.0"
  },

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

Axios has multiple known advisories, and because the manifest does not pin an exact version, it is not possible to verify from this file alone whether the installed release is affected. In the context of a news/intelligence skill that likely performs outbound HTTP requests, a vulnerable HTTP client could increase exposure to SSRF, MITM, credential leakage, or response-handling issues depending on how the library is used elsewhere.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The rss-parser dependency is specified with a caret version range, so the installed package may vary over time. This creates a low-severity supply-chain risk by weakening reproducibility and allowing inadvertent adoption of a newly introduced vulnerable dependency version.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "rss-parser": "^3.13.0"
  },
  "keywords": ["intelligence", "news", "ai", "makima"],
  "author": "Makima",

Static analysis

No suspicious patterns detected.